it's not their job to tell all governments "hey, you shouldn't use us like your internal documents say, and if you do don't add journalists!!"

no, they by design don't known who is using the platform and for what purpose

there isn't pretty much anything that can be done without compromising privacy, even if they did introduce some scanning AI thing that is perfect all bad actors + regular people that care about privacy would simply move to a different platform that doesn't do it

what are they supposed to do? break encryption?

no one expects you to believe anything, the source code is public and you can go check it out yourself or trust the many independent audits